FAQ: security
This page answers the security questions that security officers and evaluation panels in public bodies ask about
Exponential. The answers come from Security standards, SECURITY.md and the
hardening guides.
Contents
- How does Exponential address the OWASP Top 10?
- Has it been assessed against OWASP ASVS or penetration tested?
- Does it support two-step sign-in?
- Are accounts locked after failed sign-ins?
- Can we see who did what?
- Does it send a Content Security Policy?
- How are vulnerabilities reported and fixed?
- What must we harden ourselves?
How does Exponential address the OWASP Top 10?
Every category of the OWASP Top 10 (2021) has built-in mitigations, mapped one by one on
Security standards: role-based access checks, password hashing with
password_hash(), output escaping, CSRF tokens on forms, security headers, a tamper-evident audit trail, SSRF checks
and more. The status is Partly complies: "Complies" would need an external assessment, which has not been made.
Has it been assessed against OWASP ASVS or penetration tested?
No ASVS assessment has been made; status Unverified. The default minimum password length (10) is below ASVS level 1's 12, so level 1 needs a settings change (Security standards). No penetration test report is published in the repository. The kernel has had three documented hardening passes. If your rules require a test, commission one for your site.
Does it support two-step sign-in?
Yes, opt-in: the extension sevenx_authentication_2fa adds a code from an authenticator app or by e-mail after the
password (Two-step sign-in).
Are accounts locked after failed sign-ins?
Not by default: MaxNumberOfFailedLogin=0. You can set a limit, with a trusted address list. Brute force is detected
by the audit alert rules, and rate limiting is left to the web server or a request filter such as request-shield
(Security standards, Security hardening).
Can we see who did what?
Yes. The audit trail is on by default and hash-chained, records sign-ins, content changes, settings writes and more,
and has alert rules (Audit trail). It can be verified with
./console exp:audit verify (Security and audit).
Does it send a Content Security Policy?
Yes, built from site.ini [ContentSecurityPolicy] with per-request nonces and a report collector. As shipped it is
report-only on the administration and off on public sites; enforcement is the operator's decision per siteaccess
(Content Security Policy).
How are vulnerabilities reported and fixed?
Privately by e-mail to the address in SECURITY.md, with "a first answer within one business day". Accepted issues
are fixed on main and published with the next 6.0.x release; published versions are never changed. No time to fix is
promised. No security.txt is shipped (Security standards).
How to plan for this: Security updates and patching cadence.
What must we harden ourselves?
HTTPS and HSTS, the lockout decision, password length, two-step sign-in, CSP enforcement, restricting the
administration, a request filter, dependency checks with composer audit (not run in the project's CI), and server
hardening. The guides: Security hardening,
13. Security hardening for production,
Security checklist.
Related pages
- Government FAQ
- Security standards
- Security checklist
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.